www.it-connect.fr
How Simple Scheduled Tasks Let Him Hold His Employer Hostage for 32 Months
No ransomware, no exploited vulnerability, and yet Daniel Rhyne managed to hold his employer’s infrastructure hostage. He relied on a hidden virtual machine and about fifteen scheduled tasks on a domain controller, and he has now been sentenced to 32 months in prison. Here’s what to know.
On September 28, 2026, Daniel Rhyne, 59, was sentenced to 32 months in federal prison by Judge Michael A. Shipp at the Trenton courthouse in New Jersey. On April 1, he had pleaded guilty to extortion and intentional damage to a protected computer system. He was then facing up to 5 years in prison for the first count and 10 years for the second.
If this story sounds familiar, that’s normal: I already covered it when this man was arrested after blocking access to 254 servers in order to extort his former employer in August 2024. He was then working for an industrial company in New Jersey (whose name has not been disclosed) as an IT engineer, with responsibility including managing the virtual infrastructure. He was therefore still employed at the time of the events, which is no longer the case.
A ghost VM and scheduled tasks on the domain controller
The criminal complaint filed by the FBI explains the sequence of events in quite a bit of detail, and especially what Daniel Rhyne did. It all began on November 9, 2023, when he created a virtual machine on the company network, with the password "TheFr0zenCrew!". That same day, from his company laptop, he opened a company Excel file containing passwords, including that of a domain administrator. On November 15, Sysinternals tools were placed on the domain controller.
On Saturday, November 25, 2023, two days after Thanksgiving, a Remote Desktop session was launched from this VM to the domain controller at 7:48 a.m. Eastern Time. In less than two hours, around 16 scheduled tasks were created. Six of them were set to trigger starting at 4:00 p.m. And they were not there to check whether Active Directory was in good health — no, they were there to do damage:
- Domain accounts: deletion of 13 domain administrator accounts and password change for the administrator account in use, with
net user. - User accounts: password reset for 301 accounts to the value "TheFr0zenCrew!".
- Servers and workstations: using
PsPasswd, the passwords of two local administrator accounts targeting 254 servers were changed, and two others targeting 3,284 workstations.
The other tasks were supposed to shut down dozens of servers starting on December 3. At 4:44 p.m., several employees received an email titled "Your Network Has Been Penetrated". "All IT administrators have been blocked or removed," it read. The message also announced the deletion of backups and threatened to shut down 40 servers per day for 10 days unless a ransom was paid before December 2. The amount: 700,000 euros in the form of 20 bitcoins (about $750,000 at the time). A genuine hostage-taking.
Betrayed by his own traces
By carrying out these manipulations, Daniel Rhyne left traces behind, and they made it possible to track him down. Indeed, the FBI complaint cites a set of clues that clearly identify this IT engineer. These include:
- The ghost VM: it was accessed from Daniel Rhyne’s company account and company laptop. In addition, web browsing on the laptop would stop whenever it resumed on the VM, a sign that the same person was using both.
- The badge and cameras: access logs and headquarters surveillance footage show him entering the premises a few minutes before his account connected to the laptop, then often to the VM.
- His home IP address: on days when he did not come to the office, the laptop connected to the network from his home before accessing the VM. That is what happened on the morning of November 25, just before the scheduled tasks were created.
- Web searches: on November 15, searches launched from his laptop were about changing the local administrator password from the command line. On November 22, from the VM, they concerned domain password resets, account deletion, and Windows log erasure.
- The password: the mailbox used for the ransom demand was protected by "TheFr0zenCrew!", the same password as the VM and the 301 accounts that were reset.
It is therefore fairly easy to establish a link between the malicious actions and Daniel Rhyne after reading all of this.
What to take away from this...
This story should also serve as a lesson, and if you want to avoid something like this happening to you, what can you do? Without going too deep into the details, three topics already stand out:
- The password spreadsheet: the domain administrator password was stored in a simple file. No comment, some might say. An enterprise password manager is more than necessary to restrict access to this information and audit who views it. Privilege segmentation is another matter.
- Local administrator accounts: two accounts for 254 servers, two others for 3,284 workstations. This suggests the same passwords may have been reused across the fleet, something that my tutorial on configuring Windows LAPS with Active Directory is designed to prevent.
- Monitoring the domain controller: 16 scheduled tasks created on a DC on a Saturday morning should stand out. With the right auditing policy, Event 4698 (scheduled task creation) in the Security log can trigger an alert. A SIEM or log sink would not be luxury either. Need I remind you how important log centralization is?
